Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
15/04/2024, 13:59
General
-
Target
f13a56197946ac0161c27f9172011b71_JaffaCakes118.exe
-
Size
82KB
-
MD5
f13a56197946ac0161c27f9172011b71
-
SHA1
985805e540955bca331affec46d900a129e54816
-
SHA256
fc8f8dde953b9788caf58c1e568c60803399a7cb60242c41729347b3077ad47c
-
SHA512
125dfe53aa3721fd61ecd2ecb7f3ceed6ee93c2ceaa2ab16e601ac1d8ed1b4aa2078708687810924febfb2e86fb7d5fb46f1613bf344e3fb3d7a45609960fa65
-
SSDEEP
1536:Nv0nDdTwXC54k58LsfckwJvz1767nQH+DJ8bV1guzmvxcRtiLKU:NMnJTtqsfLwV1767nQm6hlzm5cRwz
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f13a56197946ac0161c27f9172011b71_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f13a56197946ac0161c27f9172011b71_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f13a56197946ac0161c27f9172011b71_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f13a56197946ac0161c27f9172011b71_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD517ce44aa471c6625c04e2a66020416d0
SHA1acee8268b818d3827ce5248d209429644b09b143
SHA256c1bce7bf3800fd79b30f633d8a281c174f0a59a24f559b2c39e8b72cd262363a
SHA512fb814cd5af444c391afa0ace28d25cdca94d13ed9ca69266108058a243537576702daf5a623dc81d55135f345fb2d6541585f629a0089b2ab77d42fd7834fce5
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
56KB
-
Filesize
108KB